[mojo-edk] Add some buffer checks and fix UAF on NodeChannel

mojo/edk/system/node_channel.cc

Index: mojo/edk/system/node_channel.cc
diff --git a/mojo/edk/system/node_channel.cc b/mojo/edk/system/node_channel.cc
index dddb57724eab912ebfe9f03b49defe66ebe36309..bde3fba91de65993d9ee62bd2825a924d724d2da 100644
--- a/mojo/edk/system/node_channel.cc
+++ b/mojo/edk/system/node_channel.cc
@@ -394,6 +394,11 @@ void NodeChannel::OnChannelMessage(const void* payload,
 
   RequestContext request_context(RequestContext::Source::SYSTEM);
 
+  // Ensure this NodeChannel stays alive through the extent of this method. The
+  // delegate may have the only other reference to this object and it may choose
+  // to drop it here in response to, e.g., a malformed message.
+  scoped_refptr<NodeChannel> keepalive = this;
+
 #if defined(OS_WIN)
   // If we receive handles from a known process, rewrite them to our own
   // process. This can occur when a privileged node receives handles directly
@@ -674,6 +679,9 @@ void NodeChannel::ProcessPendingMessagesWithMachPorts() {
     }
   }
 
+  // Ensure this NodeChannel stays alive while flushing relay messages.
+  scoped_refptr<NodeChannel> keepalive = this;
+
   while (!pending_relays.empty()) {
     ports::NodeName destination = pending_relays.front().first;
     Channel::MessagePtr message = std::move(pending_relays.front().second);